WebEx Downloader Plug-in ActiveX Unspecified Remote Code Execution

2006-07-06T07:34:04
ID OSVDB:27040
Type osvdb
Reporter Mark Dowd(Avert@avertlabs.com), David Dewey()
Modified 2006-07-06T07:34:04

Description

Vulnerability Description

WebEx Downloader plug-in contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the ActiveX control installed by WebEx not properly sanitizing user input supplied to the the "GpcUrlRoot" and "GpcIniFileName" variables. This may allow an attacker to include a DLL file from a remote host that contains arbitrary commands which will be executed by the vulnerable object under the security context of the user viewing the web page.

Solution Description

Upgrade to version SP30 (see Vendor Specific Solution URL) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Short Description

WebEx Downloader plug-in contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the ActiveX control installed by WebEx not properly sanitizing user input supplied to the the "GpcUrlRoot" and "GpcIniFileName" variables. This may allow an attacker to include a DLL file from a remote host that contains arbitrary commands which will be executed by the vulnerable object under the security context of the user viewing the web page.

References:

Vendor Specific Solution URL: http://www.webex.com/go/downloadSP30 Vendor Specific News/Changelog Entry: http://www.webex.com/lp/security/ActiveAdv.html?TrackID=123456 Secunia Advisory ID:20956 Related OSVDB ID: 27039 Other Advisory URL: http://xforce.iss.net/xforce/alerts/id/226 Other Advisory URL: http://www.zerodayinitiative.com/advisories/ZDI-06-021.html Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0076.html Keyword: #WEBX-06-1-1 FrSIRT Advisory: ADV-2006-2688 CVE-2006-3424